This guide serves as a reference of collected information necessary for strict
management of PGP keys. This includes keeping a master key that always remains
offline and while subkeys on an OpenPGP smart card. OpenPGP cards can be
purchased at kernelconcepts.de. More information can be found at:
http://g10code.com/p-card.html

Tails live privacy enhanced version of debian runs as a live CD or USB. This
guide will assume you are using this. It currently lacks the necessary packages
to use the smart cards so we will have to manually ferry those Debian packages
to Tails. Abel on Github who I forked this Gist from is working on a customized
version of Tails called 'Clean Room' that will include the necessary software
and forcibly keep you offline. This guide will be updated to reflect that. Clean
Room will also automate many of these tasks, but this guide will preserve all
the information needed to do so manually. This will ensure you have to building
blocks to manage your keys as you see fit. You might not have a PGP smartcard,
but want to ensure you manage a offline master key for example The important
principle is that you keep your master key offline.

Installing Smart Card Drivers

Install the smartcard driver and daemon packages: apt-get install libccid pcscd. You'll need to download the debs (apt-get download) from your work computer and place them on a USB so that you can transfer them to your live CD.

Specifically, I have found it necessary to manually download these .deb files from the wheezy release of Debian:

Create Backups

Export the secret keys for your subkeys (does NOT include master secret key):

$ gpg -a --export-secret-subkeys > sub-secret-keys.gpg

Save Backups

Backup the following to the super-safe USB stick that is never plugged in to an online machine. Store this USB stick in your ork guarded vault:

master-secret-key.gpg - copy of your master secret key

sub-secret-keys.gpg - copy of your secret sub keys

~/.gnupg - your entire keyring. It will be used as the GNUPGHOME for future subkeys.

Move the subkeys to the card

Now we will transfer the subkeys generated before to the smartcard. The existing secret keys will be replaced by stubs. If your card gets damaged, you can repeat that step by simply using the backup we brought to the Orks.

The following was copy/pasted from the FSFE article, which uses a smaller key size. What we're doing here is selecting the encryption and signing subkeys and moving them to the card.

You can tell which subkey is which by looking at the usage: X, where X is S for signing or E for encryption.

After this is done, your secret-subkeys will only exist:

On the smartcard

On the ork-guarded USB stick (in the saved .gnupg/ and sub-secret-keys.gpg)

$ gpg --edit-key 559C215F
gpg (GnuPG) 1.4.9; Copyright (C) 2008 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Export Stubs and Public Key

Export the public key for your identity key:

$ gpg -a --export 5AD20E1D > pub-key.gpg

Export the secret key stubs for your subkeys. This doesn't include the actual secret keys since they were moved to the smart card, but act as a pointer of sorts to your smartcard. When you import this and your public key to your work computer gnupg will know to look on your smart card when it needs to access one of your private subkeys.

$ gpg -a --export-secret-subkeys > sub-key-stubs.gpg

Backup pub-key.gpg and sub-key-stubs.gpg to the other USB stick that you used to transfer the
drivers. This will be imported on your main machine.